Author Topic: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2) (Read 326775 times)

calle2010 · « **Reply #175 on:** April 04, 2019, 12:49:18 AM »

Quote from: names_are_hard on April 03, 2019, 11:25:41 PM

I made some changes but git push gave me a 403, so I guess I can't submit a pull request?

You could create a PR from your own fork. But you can't directly push to another repository if permissions haven't been setup.

Thank you very much for the edits. I took them over manually. What started as my personal notes for the 77D may turn into a ML Ghidra guide.

Quote

I think you have the "language" wrong, and should be using ARM Cortex 32 little endian, not ARM v7.

I will check this. I though ARM v7 architecture is correct for the Cortex A9 processor? Actually I'm a bit confused by the choices in Ghidra...

Quote

Second, you shouldn't load each ROM as a file in your Ghidra project (I made this mistake too). This makes each file separate and disassembly can't see stuff in the other files, so you will get lots of broken refs. Instead, load the main ROM, then use File -> Add To Program. This puts all the files in the same address space and disassembly works much better.

Actually this is what I do, but my language was not clear enough.

Quote

Third... I should really write a Ghidra script that reads stubs.S and disassembles and labels every code address.

...and also for named_functions.idc :-)

Btw: I use F12 always instead of D since the thumb flag is not persisted. In the next session "D" may try to analyze ARM instead of Thumb again. Nearly all code of the 77D seems to be Thumb.

names_are_hard · « **Reply #176 on:** April 04, 2019, 03:33:31 AM »

Quote from: calle2010 on April 04, 2019, 12:49:18 AM

You could create a PR from your own fork. But you can't directly push to another repository if permissions haven't been setup.

Okay, makes sense, thanks.

Quote

I will check this. I though ARM v7 architecture is correct for the Cortex A9 processor? Actually I'm a bit confused by the choices in Ghidra...

Earlier in this thread Alex says it's Cortex. I may be wrong that it makes a difference, I thought that all Cortex were v7 but not all v7 were Cortex, but now I'm not sure. I looked at the Ghidra definitions in Ghidra/Processors/ARM/data/languages and it seems they're treated very similarly. I think Cortex might default to Thumb, where v7 doesn't. Might explain why D works fine for me most of the time?

Quote

...and also for named_functions.idc :-)

Yes, similar thing, should be easy. Although named_functions doesn't find much for me. I guess because emulation is quite limited so far.

aprofiti · « **Reply #177 on:** April 04, 2019, 08:22:21 AM »

Found stubs for 800D 1.0.1 and ~~6D2 1.0.3~~ 6D2 1.0.4; now they have possibility to join the party

You should be able to save a log from startup as the other d7 cameras (please test and report).
Next step will be to find bmp_vram_info for hello world code, then start to port ML.

Is there someone who has these cameras and is willing to try bootflag enabler?

edit: Updated 6D2 stubs list to 1.0.4

totalmichel · « **Reply #178 on:** April 04, 2019, 11:37:44 AM »

Quote from: aprofiti on April 04, 2019, 08:22:21 AM

Found stubs for 800D 1.0.1 and 6D2 1.0.3; now they have possibility to join the party

You should be able to save a log from startup as the other d7 cameras (please test and report).
Next step will be to find bmp_vram_info for hello world code, then start to port ML.

Is there someone who has these cameras and is willing to try bootflag enabler?

i have an 6D2 but it has the latest firmware 1.0.4

aprofiti · « **Reply #179 on:** April 04, 2019, 01:30:57 PM »

You can try the FIR version of the rom dumper and ask a1ex for bootflag enabler (after that It is possibile to run custom binary on camera).

Then share the dump (send a PM) so we can work on an updated version (time consuming but it should be worth if there is collaboration) for 1.0.4.

totalmichel · « **Reply #180 on:** April 05, 2019, 06:18:38 PM »

a1ex can you send me the bootflag enabler for 6D2?

just finished sending the 1.0.4 dump to aprofiti

buro341 · « **Reply #181 on:** April 11, 2019, 08:36:37 PM »

just a supporter here, how are things going guys?

names_are_hard · « **Reply #182 on:** April 11, 2019, 08:45:16 PM »

There is the expected slow progress. It will likely be several months minimum before anything major happens.

Nicolas Apud · « **Reply #183 on:** April 12, 2019, 12:54:38 AM »

Hi, I have a 6D2 and I would like to help
nicolasapud1@gmail.com

buro341 · « **Reply #184 on:** April 15, 2019, 05:28:55 PM »

Thnx for the info. I really don't like ipb for the 77d

tekrevz · « **Reply #185 on:** April 16, 2019, 03:12:30 AM »

I know this is a naive question. But how quickly /easy would a change to bitrate of the 6dm2 video be. Could you theoretically go into the code and just change the number?

scrax · « **Reply #186 on:** April 16, 2019, 01:02:39 PM »

Quote from: tekrevz on April 16, 2019, 03:12:30 AM

I know this is a naive question. But how quickly /easy would a change to bitrate of the 6dm2 video be. Could you theoretically go into the code and just change the number?

ML don't changes any code in canon firmware, so for any function ML need to be ported for the cam at first, before doing anything

names_are_hard · « **Reply #187 on:** April 23, 2019, 10:54:54 PM »

I'm having problems finding stubs for 200D. I have almost all of them found (can probably mock out the rest for now), except the EDMAC family, which look quite important. Does anybody on a Digic 7 cam have any found? It looks to me that something important changed. There are very few EDMAC related strings on 200D. Case insensitive grep for edmac gives me 138 unique strings on 50D, 12 on 200D.

The only one that looks like a function name is WriteEDmacCompleteCBR, but that's not in stubs for other cams and hasn't been a good enough clue for me so far to locate the rest.

names_are_hard · « **Reply #188 on:** April 25, 2019, 12:16:49 AM »

Possibly related, 200D has PCIe related strings, including:

WriteDMAPCIeCom
WriteDMAPCIeCom
ReadDMAPCIeCom
ReadDMAPCIeCom
CompletePCIe_DMA
CompletePCIe_DMA

There are also xdmac strings, not very many, some are close to some PCIe strings. I'm not convinced there's a link to edmac, but I'll explore further.

calle2010 · « **Reply #189 on:** April 25, 2019, 07:50:35 PM »

Quote from: names_are_hard on April 25, 2019, 12:16:49 AM

There are also xdmac strings, not very many, some are close to some PCIe strings. I'm not convinced there's a link to edmac, but I'll explore further.

Thank you for sharing the information. Currently I have very little time to spend on ML. I think in May I would try to catch up with the 77D stubs based on yours and also try to understand the EDMAC.

names_are_hard · « **Reply #190 on:** April 29, 2019, 12:06:19 AM »

Also perhaps noteworthy, a family of new "lime" strings, eg:

LimeXdmac/XdmacApi.c
LimeSdIo/SdWlanIf/SdWlanIf.c
[NWCOM] Lime WorkLoad DMA
LimeSdIo/SdWlanIf/SdWlanIf.c
platform/lime/sd_wif11n.c

Many, though not all, seem to be wifi related - 200D does have wifi. So perhaps this is a dma controller for that only, and doesn't replace Edmac? Or perhaps Canon consolidated all DMA with a new controller.
I found this Fujitsu link which might be relevant, but could just be a naming coincidence:
https://www.fujitsu.com/us/products/devices/semiconductor/gdc/doc/an-dma.html

kitor · « **Reply #191 on:** April 29, 2019, 09:00:21 AM »

As for lime strings, from EOS R:

Code: [Select]

"NetDomain::LimeKick.c":
"LimeInit":
"Error : bad parameter(LimeClock).":
"Inport(CCLIME_TIC_WDLPS_ADDR) == val":
"Inport(CCLIME_TIC_WDLP_EN_ADDR) == val":

"LimeSdIo/SdDom/SdClk.c":
"LimeSdIo/SdDom/SdCmd.c":
"LimeSdIo/SdDom/SdCommon.c":
"LimeSdIo/SdDom/SdCon.c":
"LimeSdIo/SdDom/SdDebug.c":
"LimeSdIo/SdDom/SdDma.c":
"LimeSdIo/SdDom/SdDom.c":
"LimeSdIo/SdDom/SdIo.c":
"LimeSdIo/SdDom/SdLog.c":
"LimeSdIo/SdDom/SdReg.c":
"LimeSdIo/SdDom/SdResource.c":
"LimeSdIo/SdWlanIf/SdWlanIf.c":
"LimeSdIo/SdWlanIf/SdWlanIfConfig.c":
"LimeXdmac/XdmacApi.c":
"LimeXdmac/XdmacDrv.c":
"LimeIntc.c":
"LimeKick.c":
"CclimeSdIo/TsumSd/SdCmd.c":
"CclimeSdIo/TsumSd/SdCon.c":
"CclimeSdIo/TsumSd/SdDma.c":
"CclimeSdIo/TsumSd/SdIo.c":
"CclimeSdIo/SdWlanIf/SdWlanIf.c":

"[NWCOM] Lime Load Complete For XDmac(Ch=%d)":
"[NWCOM] Lime Load Complete For CPU":
"[NWCOM] LimePanic":
"[NWCOM] LimeExcept":
"[NWCOM] LimeAssert":
"[NWCOM] Lime WorkLoad CPU":
"[NWCOM] Lime WorkLoad (DMA)->CPU":
"[NWCOM] Lime Init":
"[NWCOM] Lime Uninit":

and more. So seems to be related to WiFi / SDIO is used for WiFi card internally (that's interesting)

names_are_hard · « **Reply #192 on:** April 29, 2019, 09:33:03 PM »

Thanks for the comparison. How many edmac strings do you have? EOS R is Digic 8, it would be interesting if it still had the 100s that old cameras have. My guess is it'll have 10s like 200D.

kitor · « **Reply #193 on:** April 29, 2019, 09:45:32 PM »

Code: [Select]

kitor@kitor-pc:eosr-120$ cat ROM0.BIN.strings | grep -i edmac | wc -l
121
kitor@kitor-pc:eosr-120$ cat ROM0.BIN.strings | grep -i pcie | wc -l
70

josecarlosss · « **Reply #194 on:** May 04, 2019, 02:41:40 AM »

Hi guys, i am an owner of a Canon 77D, and i was wondering how can i help to make the magic lantern useable for 77D.

Is there any news about the built for 77D?

Best regards
Stelios

Walter Schulz · « **Reply #195 on:** May 04, 2019, 02:49:20 AM »

Quote from: josecarlosss on May 04, 2019, 02:41:40 AM

Hi guys, i am an owner of a Canon 77D, and i was wondering how can i help to make the magic lantern useable for 77D.

Build a development environment, startup QEMU, dump ROM files and make your first steps inside the emulator.
Tutorials how to make QEMU run are available.

names_are_hard · « **Reply #196 on:** May 05, 2019, 02:22:43 AM »

Quote from: kitor on April 29, 2019, 09:45:32 PM

Code: [Select]
kitor@kitor-pc:eosr-120$ cat ROM0.BIN.strings | grep -i edmac | wc -l 121 kitor@kitor-pc:eosr-120$ cat ROM0.BIN.strings | grep -i pcie | wc -l 70

So it seems Digic 7 is the strange one! I have found some DMA related code now, "DmacCh" was a useful string. I can see some possible init code around 0xe007e02c.

kitor · « **Reply #197 on:** May 05, 2019, 10:37:37 AM »

Quote from: Walter Schulz on May 04, 2019, 02:49:20 AM

Build a development environment, startup QEMU, dump ROM files and make your first steps inside the emulator.
Tutorials how to make QEMU run are available.

Walter, I see a similar post from time to time.
Unfortunately (from few years experience working with developers (!, so people who should know the drill) in quite large project), I don't think people who ask those questions does understand problem at all.

For average person installing software on new PC is like... download it and install. They think that the problem is that with their new camera no one yet tried to download and install ML and provide feedback that it works (yup, I'm oversimplifying, but again, experience tells me to expect low unless proven wrong).

We know that ML code doesn't grow on trees. (great quote btw!). But this means nothing even for pro photo/videographers who used ML for living, if they don't have any computer engineering background.

IMO, the real answer should be like:

Quote from: kitor's alter ego

Unless you know or want to learn how to do any of this, wait patiently for news containing download links, or grab a camera that is supported now.

Sorry for OT, but something tells me this post may be much better answer for all people asking.

totalmichel · « **Reply #198 on:** May 14, 2019, 01:42:04 PM »

Im willing to test the bootloader enabler on my spare 6D2 and also run any test

totalmichel · « **Reply #199 on:** June 14, 2019, 06:37:14 PM »

maybe its a dumb question
the 6d2 was a mov 4k codec available for timelapse mode
is there any way to activate it for regular movie without the need to fully develop magic lantern for it? maybe some special code that if the cam turns on on movie mode enables it?

News:

Author Topic: DIGIC 7 development (200D/SL2, 800D/T7i, 77D, 6D2) (Read 326775 times)